Verify hh2 Software Signatures and the Thin Client Service

Download to share the overview

What this means for finance and payroll teams

You don't need to do anything. This is a security update to the hh2 software installed on your accounting server. Please forward this article to whoever manages that server.

One thing worth knowing: a Windows service named hh2 Thin Client needs to stay running. If it's stopped or disabled, data from your accounting system stops reaching hh2. You'd see missing or stale information in hh2 until it's running again.

The rest of this article is written for the person who manages that server.

What changed in 26.29.0

Two things, and they're related.

Our programs are signed. Windows can now confirm that an hh2 program genuinely came from hh2 and hasn't been altered since we built it. Where the Sync Client Installer used to show the publisher as unknown, it now names hh2 Cloud Services, on the installer and on every program it installs.

Our programs say who we are. Some hh2 programs used to report no company name at all, which made them hard to identify in Task Manager or a security console. Every one of them now reports hh2 Cloud Services and the product it belongs to.

Signing starts at 26.29.0. Earlier builds are unsigned.

What the hh2 Thin Client service is

If your hh2 Synchronization Client has updated to 26.28.0 or later, you have a second Windows service named hh2 Thin Client. It's a genuine hh2 component, installed by the same hh2 update your team already approved, and hh2 needs it running.

What it does

It's the new connection between your accounting system and hh2. The older components ask hh2 for instructions every few seconds, around the clock. The Thin Client instead holds one secure connection out to your own hh2 site and waits to be told when there's work to do.

That means it's quieter on your network, it recovers from outages on its own, and because settings now live in hh2 rather than on the server, your team no longer maintains configuration on the machine itself.

What it does on your network

It makes outbound connections only, over the standard encrypted web port (TCP 443).
It connects only to your own hh2 web address, the same one your staff already sign in to. There's no new destination for you to allow.
Your data is encrypted in transit, and encrypted at rest once it reaches hh2.
It accepts no incoming connections. It needs no firewall exceptions, no open ports, and no inbound rule changes.
It's not a remote-access tool, and it doesn't install other software.
It has no access to documents, browsers, or mail on the machine.
It holds no long-lived credentials. The service trades its existing hh2 site token for a short-lived one, and gets a new one on every connect and reconnect.
Each delivery uses a separate short-lived, write-only, single-use permission issued by hh2 for one batch of data. The software on your machine can't read data back, list what's been sent, or delete anything.
hh2's servers decide where data goes, not the machine. That makes reaching another customer's data structurally impossible rather than only disallowed.

What happens if it's turned off

With the service stopped or disabled, the data hh2 collects from your accounting system through this channel stops arriving. Depending on which hh2 features you use, that can mean missing or stale information in hh2 until the service is running again.

How to verify hh2 software on your server

Everything below can be checked on the machine in front of you. Nothing here asks to be taken on trust.

Signature details

Property	Value
Certificate subject	CN=hh2 Cloud Services, O=hh2 Cloud Services, L=Kaysville, S=Utah, C=US
Issued through	Azure Artifact Signing (Microsoft managed signing service)
Trust	Publicly trusted, chains to a Microsoft root already present in Windows
Timestamped	Yes. Signatures stay valid after the certificate expires
Covers	Both installers, updater.exe, and all five installed executables
From version	26.29.0. Earlier builds are unsigned

The signing certificate is held in a Microsoft-managed hardware security module certified to FIPS 140-3 Level 3. No hh2 employee can export the key, and no signing key exists on any laptop or build machine. Signing happens only inside our release pipeline, and every signature is timestamped and logged. Before issuing the certificate, Microsoft independently validated hh2 Cloud Services against business registration records.

Service and binary identity

Property	Value
Service name	hh2ThinClient
Display name	hh2 Thin Client
Executable	hh2.ThinClient.exe
Publisher	hh2 Cloud Services
Product	hh2 Synchronization Client
File version	Matches the client release, for example 26.29.0.0
Runs as	LocalSystem, automatic start, own process
Architecture	32-bit, self-contained, single file
Installed by	hh2 Synchronization Client MSI, 26.28.0 and later

Commands to run

Run these on the machine hosting the hh2 Synchronization Client.

Service configuration, including the full binary path:

sc.exe qc hh2ThinClient

Signature and publisher metadata (PowerShell):

<pre><code>$svc = Get-CimInstance Win32_Service -Filter "Name='hh2ThinClient'"
$exe = $svc.PathName.Trim('"')
Get-AuthenticodeSignature $exe | Format-List Status, SignerCertificate, TimeStamperCertificate
(Get-Item $exe).VersionInfo | Format-List CompanyName, ProductName, FileDescription, FileVersion</code></pre>

Confirm the service is outbound only. Expect no LISTENING entries for this process:

Get-NetTCPConnection -OwningProcess $svc.ProcessId |     Format-Table LocalPort, RemoteAddress, RemotePort, State

What you should see. On 26.29.0 and later, Status returns Valid, the signer is hh2 Cloud Services, and the timestamp is populated. Right-clicking the file and choosing Properties, then Digital Signatures, shows the same thing.

Two things that look wrong but aren't

You may still see a SmartScreen warning

Downloading the installer with a browser can still bring up "Windows protected your PC" from Microsoft Defender SmartScreen. That check is separate from the signature. It asks whether Microsoft has seen this particular file downloaded widely enough yet, and a newly issued signing identity has no such history. The warning fades as a release circulates.

The signature is still doing its job underneath, and the dialog shows it. Select More info and confirm the publisher reads hh2 Cloud Services. That line is the thing worth checking. It's what an unsigned or tampered file can't produce. If it says anything else, don't continue, and contact our Support Team at support@hh2.com or (877) 442-9327.

SmartScreen applies only to files carrying the Mark of the Web, so packages the hh2 updater fetches aren't subject to it. Machines that update themselves are unaffected.

The install folder says Digital Business Integration

The installation folder is C:\ProgramData\Digital Business Integration\hh2 Synchronization Client (64-bit)\, and Programs and Features still lists the publisher as Digital Business Integration. That was hh2's registered company name before it became hh2 Cloud Services. The certificate carries the current legal name, which is why the two differ. We're flagging it so it isn't a surprise during a review.

If your team already disabled the service

Service present but stopped or set to Disabled: run sc.exe config hh2ThinClient start= auto, then sc.exe start hh2ThinClient.
Executable missing: a security product quarantined it. Restore it and allow the service, or re-run the hh2 Synchronization Client installer.
If you added an exception by file path: consider replacing it with one based on the publisher hh2 Cloud Services. It will survive future updates.
The service reconnects on its own once running, and a machine that's been offline catches up without manual work.

Please tell us either way, so we can confirm from our side that it reconnected. Contact our Support Team at support@hh2.com or (877) 442-9327.

Why we made this change

When 26.28.0 added the hh2 Thin Client service, a number of customers' IT teams found a program they didn't recognize, running with system privileges, carrying no signature and no company name. Some disabled it. That was the right instinct on the information available.

We should have told you the service was coming, and we're sorry we didn't.

Signing is our answer. It gives your security team something to verify rather than something to take on trust, and it makes every hh2 update after this one easier to review and approve.

Frequently asked questions

Do I need to open a firewall port or allow a new destination? No. The service makes outbound connections only, on TCP 443, to your own hh2 web address. There's no inbound listener and no new hostname to allowlist.

Does this give hh2 remote access to our server? No. It's not a remote-access tool. There's no remote shell, no remote desktop, and no interactive control. It doesn't distribute software, and it has no access to documents, browsers, or mail on the machine.

Why is the service 32-bit? It loads the Sage 300 CRE (Timberline) data driver in-process, and that driver is 32-bit only. The 32-bit build is required for Sage compatibility, which is why it ships inside the 64-bit installer.

Why did a new service appear without notice? It was added to the 26.28.0 release of the client you already run, so it installed with that update. We should have told you it was coming, and we're sorry we did not.

Will older hh2 versions be signed? No. Signing starts at 26.29.0. Builds before that are unsigned.

Can the service reach another customer's data? No. The service identifies your tenant, and hh2's servers decide the destination. Software on your machine can't select it.

What if the publisher shows something other than hh2 Cloud Services? Stop, don't continue the install, and contact our Support Team at support@hh2.com or (877) 442-9327 immediately.

Need help?

Contact our Support Team at support@hh2.com or (877) 442-9327.